| 93 | /// Finalize and return the `OcsfEvent`. |
| 94 | #[must_use] |
| 95 | pub fn build(self) -> OcsfEvent { |
| 96 | let activity_name = self |
| 97 | .activity_name |
| 98 | .unwrap_or_else(|| self.activity.network_label().to_string()); |
| 99 | let mut metadata = |
| 100 | self.ctx |
| 101 | .metadata(&["security_control", "network_proxy", "container", "host"]); |
| 102 | if let Some(source) = self.log_source { |
| 103 | metadata.log_source = Some(source); |
| 104 | } |
| 105 | |
| 106 | let mut base = BaseEventData::new( |
| 107 | 4001, |
| 108 | "Network Activity", |
| 109 | 4, |
| 110 | "Network Activity", |
| 111 | self.activity.as_u8(), |
| 112 | &activity_name, |
| 113 | self.severity, |
| 114 | metadata, |
| 115 | ); |
| 116 | |
| 117 | if let Some(detail) = self.status_detail { |
| 118 | base.set_status_detail(detail); |
| 119 | } |
| 120 | if let Some(unmapped) = self.unmapped { |
| 121 | base.unmapped = Some(serde_json::Value::Object(unmapped)); |
| 122 | } |
| 123 | self.ctx |
| 124 | .apply_common_fields(&mut base, self.status, self.message); |
| 125 | |
| 126 | OcsfEvent::NetworkActivity(NetworkActivityEvent { |
| 127 | base, |
| 128 | src_endpoint: self.src_endpoint, |
| 129 | dst_endpoint: self.dst_endpoint, |
| 130 | proxy_endpoint: Some(self.ctx.proxy_endpoint()), |
| 131 | actor: self.actor, |
| 132 | firewall_rule: self.firewall_rule, |
| 133 | connection_info: self.connection_info, |
| 134 | action: self.action, |
| 135 | disposition: self.disposition, |
| 136 | observation_point_id: self.observation_point_id, |
| 137 | is_src_dst_assignment_known: Some(true), |
| 138 | }) |
| 139 | } |
| 140 | } |
| 141 | |
| 142 | impl_activity_setter!(NetworkActivityBuilder); |